The advancement of quantum computing threatens classical cryptographic methods, necessitating the development of secure quantum key distribution (QKD) solutions for QKD Networks (QKDN). In this paper, a novel key distribution protocol, Onion Routing Relay (ORR), that integrates onion routing (OR) with post-quantum cryptography (PQC) in a key-relay (KR) model is evaluated for QKDNs. This approach increases the security by enhancing confidentiality, integrity, authenticity (CIA principles), and anonymity in quantum-secure communications. By employing PQC-based encapsulation, ORR aims to avoid the security risks posed by intermediate malicious nodes and ensures end-to-end security. Our results show a competitive performance of the basic ORR model, against current KR and trusted-node (TN) approaches, demonstrating its feasibility and applicability in high-security environments maintaining a consistent Quality of Service (QoS). The results also show that while basic ORR incurs higher encryption overhead, it provides substantial security improvements without significantly impacting the overall key distribution time. Nevertheless, the introduction of an end-to-end authentication extension (ORR-Ext) has a significant impact on the Quality of Service (QoS), thereby limiting its suitability to applications with stringent security requirements.
The advancement of quantum computing threatens classical cryptographic methods, necessitating the development of secure quantum key distribution (QKD) solutions for QKD Networks (QKDN). In this paper, a novel key distribution protocol, Onion Routing Relay (ORR), that integrates onion routing (OR) with post-quantum cryptography (PQC) in a key-relay (KR) model is evaluated for QKDNs. This approach increases the security by enhancing confidentiality, integrity, authenticity (CIA principles), and anonymity in quantum-secure communications. By employing PQC-based encapsulation, ORR aims to avoid the security risks posed by intermediate malicious nodes and ensures end-to-end security. Our results show a competitive performance of the basic ORR model, against current KR and trusted-node (TN) approaches, demonstrating its feasibility and applicability in high-security environments maintaining a consistent Quality of Service (QoS). The results also show that while basic ORR incurs higher encryption overhead, it provides substantial security improvements without significantly impacting the overall key distribution time. Nevertheless, the introduction of an end-to-end authentication extension (ORR-Ext) has a significant impact on the Quality of Service (QoS), thereby limiting its suitability to applications with stringent security requirements.
The advance of quantum computing poses a significant threat to classical cryptography, compromising the security of current encryption schemes such as RSA and ECC. In response to this challenge, two main approaches have emerged: quantum cryptography and post-quantum cryptography (PQC). However, both have implementation and security limitations. In this paper, we propose a secure key distribution protocol for Quantum Key Distribution Networks (QKDN), which incorporates encapsulation techniques in the key-relay model for QKDN inspired by onion routing and combined with PQC to guarantee confidentiality, integrity, authenticity and anonymity in communication. The proposed protocol optimizes security by using post-quantum public key encryption to protect the shared secrets from intermediate nodes in the QKDN, thereby reducing the risk of attacks by malicious intermediaries. Finally, relevant use cases are presented, such as critical infrastructure networks, interconnection of data centers and digital money, demonstrating the applicability of the proposal in critical highsecurity environments.
Abstract To ensure the long-term security of anonymous communication against quantum computing threats, this paper proposes a QKD-assisted quantum secure onion routing protocol. The scheme employs a hybrid architecture comprising a star-topology QKD network, a classical onion routing network, and a blockchain-based pseudonym mechanism. By splitting trust between the central cloud and blockchain, the system prevents any single entity from compromising the complete path or session keys, thus balancing anonymity with scalability. Specifically, a quantum secure key agreement sub-protocol is designed: communicating parties XOR locally generated nonces with quantum keys and employ a hash family to achieve trust splitting. This method prevents both the central cloud and the blockchain from recovering session keys. Furthermore, a complete onion packet encapsulation process is established for layered encryption. Comprehensive analyses of correctness, security, and performance under practical QKD key rate constraints are provided. The results indicate that, under semi-honest and non-colluding assumptions, the proposed protocol achieves quantum secure anonymous communication while maintaining practical scalability.
With the advent of powerful quantum computers, an emerging quantum-resilient security mechanism within existing networks is crucial. Thus, Quantum Key Distribution (QKD), which generates symmetric secret keys with Information-Theoretical Security (ITS) for secure point-to-point communication, is present as a solution. Despite QKD’s potential, its deployment is challenging due to significant investment and infrastructure requirements. Using state-of-the-art technology, the maximum distance between nodes is limited to hundreds of kilometers, necessitating multiple nodes to relay keys. For now, QKD Network (QKDN) relies on software-defined networking (SDN) and a central orchestrator, but this centralized approach has limitations. Hence, the main challenge is to select an efficient path between key relays to avoid communication failure. To address these challenges, a more distributed approach could be envisioned. In this paper, we propose to leverage one of the distributed routing protocols, OSPF, to redefine and improve the current architecture. We propose a novel QKDN-based OSPF (Open Shortest Path First) architecture for efficient key relay routing, offering a completely different dimension to the overall network management: we modify QKDN architecture to exploit the OSPF networks and present a QKD-enabled OSPF version capable of computing the best path for key relay, offering a cost-effective and scalable solution for widespread QKD adoption.
The onion routing (OR) network Tor provides anonymity to its users by routing their encrypted traf-fic through three proxies (or nodes). The key cryptographic challenge, here, is to establish symmetric session keys using a secure key exchange between the anonymous users and the selected nodes. The Tor network currently employs a one-way authenticated key exchange (1W-AKE) protocol ntor for this purpose. Nevertheless, ntor as well as other known 1W-AKE protocols rely solely on some classical Diffie-Hellman (DH) type assumptions for their (forward) security, and thus privacy of today’s anony-mous communication cannot be ensured once quantum computers arrive. In this paper, we demonstrate utility of quantum-secure lattice-based cryptography towards solving this problem for onion routing. In particular, we present a novel hybrid 1W-AKE protocol (HybridOR) that is secure under the lattice-based ring learning with error (ring-LWE) assumption as well as the gap DH assumption. Due to its hybrid design, HybridOR is not only resilient against quantum attacks but also allows the OR nodes to use the current DH public keys and subsequently requires no modification to the current Tor public key infrastructure. Moreover, thanks to the recent progress in lattice-based cryp-tography in the form of efficient ring-based constructions, our protocol is also computationally more efficient than the currently employed 1W-AKE protocol ntor, and it only introduces small and manage-able communication overhead to the Tor protocol.
There is a need to ensure unconditionally secure communications between different sites of an organization. We use quantum key distribution (QKD) protocol to provide a continuous stream of secret key bits to each communicating pair for message encryption through one-time-pad (OTP) cryptography. Due to long distance between different sites, trusted nodes are used to relay each service key in a hop-by-hop manner from one end node to another end node of a communicating pair. In a QKD network, routes for key relaying can be affected by availability of relay key bits at trusted nodes. Also, relay key allocation among different routes can impact security. We consider the scenario of supporting multiple communicating pairs, where each pair demands delivery of a certain service key rate across the QKD network, and trusted nodes may not have sufficient relay key rates to perform bitwise encryption to protect the service key. Hence, there is a need to allocate the limited relay key bits to meet all service key delivery demands while considering its effects on security. We propose to perform jointly routing and relay key allocation to minimize attack success probability. We have formulated the joint problem as an optimization and further proposed an efficient algorithm to find the optimal solutions. We have evaluated the proposed algorithm to confirm its ability and efficiency in finding optimal routes and relay key allocations. For the specific network topology that we have adopted, results show that the minimum number of required trusted nodes increases linearly when end nodes are added to the system. Furthermore, we can achieve a higher security level by adding more trusted nodes in a QKD network. But increasing the number of trusted nodes beyond the minimum requirement may not continue to reduce significantly the attack success probability.
Anonymous communication networks (ACNs) enable Internet browsing in a way that prevents accessed content from being traced back to the user. This provides a high level of privacy, protecting individuals from being tracked by advertisers, governments, and other entities. The Tor network, a prominent example of such a network, uses a layered encryption scheme to encapsulate data packets, employing Tor nodes to obscure the routing process before the packets enter the public Internet. While Tor is capable of providing substantial privacy, its encryption relies on schemes such as RSA and Diffie-Hellman for distributing symmetric keys, which are vulnerable to quantum computing attacks and are currently in the process of being phased out. To overcome this threat, we propose a quantum resistant alternative to RSA and Diffie-Hellman for distributing symmetric keys, namely, quantum key distribution (QKD). Standard QKD networks depend on trusted nodes to relay keys across long distances. However, reliance on trusted nodes in the quantum network does not meet the criteria necessary for establishing a Tor circuit in the ACN. We address this issue by developing a protocol and network architecture that integrates QKD without the need for trusted nodes, thus meeting the requirements of the Tor network and creating a quantum secure anonymous communication network.